CVE-2026-62829

Think of SharePoint as your company’s shared bulletin board and forms system. This bug can let a person who already has a SharePoint login “edit the display” in a way that tricks other users into seeing a fake message or interface, like it’s coming from someone else. That can lead to users clicking unsafe things or doing actions they wouldn’t normally do.

This matters if you run Microsoft SharePoint Server (including Microsoft SharePoint Server 2019 or SharePoint Server Subscription Edition) and any staff, contractors, or services have SharePoint accounts that could influence page content. Because the attacker must have valid credentials for the SharePoint server, it’s mainly a risk from an internal or already-compromised account. Only consider it reachable if an attacker can log in to your SharePoint server and then get content rendered in a way that other users will view.

This is RED because the attacker path requires only a low level of privilege and relies on manipulating what users see in SharePoint, which can enable real impersonation and deception. While there’s no clear public record of exploitation for this exact CVE and it is not listed in CISA KEV, the presence of active cyber-actor patch pressure makes it important to fix quickly. Patch according to Microsoft’s fixed versions without waiting for further reporting.